There is nothing special. A Windows server always provides client with all available shared folders (both public and hidden). That is filtering is done on the client. Hence we are able to bypass it and get all the available shares. That's what the NetShareEnum API call does.